Panama — ANX-CAC §PA: Central America and Caribbean Annex, Panama Section
Document ID: ANX-CAC §PA · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]]
Language: Spanish controls (es/annex-pa.md). This English text is a convenience translation.
Applies to: Clinics established in the Republic of Panama. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.
1. Legal framework and roles
1.1 Roles. This Section governs the processing of Clinic Data by:
- VstreamX, as custodio or encargado del tratamiento (processor); and
- the Clinic, as responsable del tratamiento (controller).
1.2 The law. It is made under Law 81 of 2019 on the Protection of Personal Data (the "Law") and Executive Decree 285 of 2021 (the "Decree").
1.3 Electronic acceptance. Under Article 47 of the Decree, the relationship with the custodian may be established by contract, including by electronic means. This Section and the MDPA are that contract.
2. Content required by Article 48 of the Decree
VstreamX:
- processes the Clinic Data only according to the documented instructions of the Clinic (MDPA clause 3), and informs it if an instruction is contrary to the Law;
- adopts the security measures in MDPA Schedule 2, appropriate to sensitive health data;
- keeps the data confidential, and ensures that the persons authorised to process it are bound by confidentiality (MDPA clause 5);
- does not communicate the data to third parties, except to the authorised sub-custodians (clause 3) or where the law requires;
- engages sub-custodians only under clause 3;
- assists the Clinic in responding to the rights of access, rectification, cancellation, opposition and portability (clause 6);
- assists the Clinic in complying with its security obligations, including breach notification (clause 5), and makes available the information needed to demonstrate compliance, allowing audits (MDPA clause 12); and
- at the end of the service, returns the data to the Clinic and deletes it (MDPA clause 14).
[[TO CONFIRM: alignment of items 1–8 with the wording and numbering of Article 48 of Executive Decree 285 of 2021]]
3. Sub-custodians (Decree, Art. 49)
3.1 General authorisation. The Clinic gives a general authorisation for VstreamX to engage the sub-custodians listed in MDPA Schedule 3.
3.2 Changes. VstreamX informs the Clinic of any intended change at least 30 days in advance. The Clinic may object (MDPA clause 7).
3.3 Obligations. Each sub-custodian is bound by the same obligations as VstreamX. VstreamX remains liable for them.
4. Cross-border transfer
4.1 Contractual clauses. The Clinic Data is processed in Canada (VstreamX) and in the United States and other countries (sub-custodians). This transfer is made under the contractual clauses of this Section and the MDPA, as Article 53.1 of the Decree allows.
4.2 VstreamX's warranty. VstreamX warrants that it, and each sub-custodian, applies to the Clinic Data standards of protection equal to or higher than those of the Law and the Decree (Decree, Art. 5).
4.3 Health-services ground. The transfer is also necessary for the management of health services provided to the data subject (Law, Art. 33). This ground supports the transfer in the alternative, but does not replace the clauses.
4.4 The Clinic informs its patients. The Clinic informs its patients of the transfer under clause 9.
5. Security breaches
5.1 Notice to the Clinic. VstreamX notifies the Clinic immediately upon establishing a breach affecting the Clinic Data, and in any event within 24 hours (MDPA clause 9).
5.2 What the Clinic must do. This allows the Clinic to notify the National Authority for Transparency and Access to Information ("ANTAI") and the affected data subjects within 72 hours.
6. Rights of data subjects
VstreamX assists the Clinic within 5 business days (MDPA clause 8), including with the portability of the data in a structured, commonly used format.
7. Data Protection Officer
7.1 VstreamX's officer. As an additional guarantee under Article 47 of the Decree, VstreamX names its Data Protection Officer (Oficial de Protección de Datos) for the processing of the Clinic Data: [[TO CONFIRM: name and email of VstreamX's Oficial de Protección de Datos]].
7.2 The Clinic's officer. The Clinic records its own officer in the Service where it has one.
8. Register of databases
The Clinic keeps the register of its databases under Article 35 of the Decree. DentalX provides:
- a generator with the required fields; and
- an access log.
VstreamX cooperates with any registration the Clinic must make (MDPA clause 11.2).
9. The Clinic's obligations
The Clinic is responsible for:
- informing its patients of the items in Article 14 of the Decree, including the transfer to the United States, the use of AI and the logic involved. DentalX provides the template; and
- obtaining the patients' express consent to the processing of their health data, in a traceable form, where no other ground applies.
10. Clinical records
10.1 Change history. Under Law 68 of 2003 on patients' rights, the clinical record must keep a history of each entry with the professional, the date and the signature. DentalX keeps the audit trail described in MDPA Schedule 2. [[TO CONFIRM: that clinical entries record an immutable change history with professional, date and signature]]
10.2 Retention. The clinical record must be kept for at least 20 years after the patient's death, as Law 68 of 2003 provides. DentalX does not delete clinical records automatically. At the end of the service, the export allows the Clinic to keep them.
11. Artificial intelligence
The AI features are a decision-support tool for the professional and do not make decisions about patients. The Service labels AI output, and a professional must review it (DentalX Terms, Section 6).
12. Applicable law
The Law and the Decree apply to the processing of the Clinic Data whatever law governs the commercial relationship under MDPA clause 23.
Items to confirm before publication (Panama)
- Publication date.
- Alignment of items 1–8 with the wording and numbering of Article 48 of Executive Decree 285 of 2021 (§2).
- Name and email of VstreamX's Oficial de Protección de Datos (§7.1).
- That clinical entries record an immutable change history with professional, date and signature (§10.1).